Get-EntraServicePrincipalCredentialReport

<#
.SYNOPSIS
    Reports credential expiry across all service principals.

.DESCRIPTION
    Lists client secrets and certificates configured on every service
    principal in the tenant, along with expiry dates, so an expired
    credential does not silently break an integration until someone
    notices the failure.

.PARAMETER WarningDays
    Days ahead of expiry to flag as a warning. Defaults to 30.

.EXAMPLE
    .\Get-EntraServicePrincipalCredentialReport.ps1 -WarningDays 60

.NOTES
    Requires Microsoft.Graph.Applications with an active Connect-MgGraph
    session.

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$WarningDays = 30
)

$servicePrincipals = Get-MgServicePrincipal -All
$cutoff = (Get-Date).AddDays($WarningDays)

$report = foreach ($sp in $servicePrincipals) {
    foreach ($secret in $sp.PasswordCredentials) {
        [pscustomobject]@{
            App        = $sp.DisplayName
            Type       = "Secret"
            ExpiresOn  = $secret.EndDateTime
            ExpiringSoon = $secret.EndDateTime -lt $cutoff
        }
    }
    foreach ($cert in $sp.KeyCredentials) {
        [pscustomobject]@{
            App        = $sp.DisplayName
            Type       = "Certificate"
            ExpiresOn  = $cert.EndDateTime
            ExpiringSoon = $cert.EndDateTime -lt $cutoff
        }
    }
}

$report | Where-Object ExpiringSoon | Sort-Object ExpiresOn | Format-Table -AutoSize